RepoJournal
Elixir & Phoenix

Elixir & Phoenix

Elixir, Phoenix, LiveView, and Ecto - the BEAM web stack

Pick a date

  1. Sat 16 may
  2. Sun 17 may
  3. Tue 19 may
  4. Wed 20 may
  5. Thu 21 may
  6. Sat 23 may
  7. Sun 24 may
  8. Wed 27 may
  9. Thu 28 may
  10. Fri 29 may
  11. Sat 30 may
  12. Sun 31 may
  13. Mon 8 jun
  14. Tue 9 jun
  15. Wed 10 jun
  16. Thu 11 jun
  17. Fri 12 jun
  18. Sat 13 jun
  19. Sun 14 jun
  20. Mon 15 jun
  21. Tue 16 jun
  22. Wed 17 jun
  23. Thu 18 jun
  24. Sat 27 jun
  25. Mon 29 jun
  26. Tue 30 jun
  27. Wed 1 jul
  28. Thu 2 jul
  29. Fri 3 jul
  30. Today 4 jul

The Wire · Showcase

PHOENIX TIGHTENS LONGPOLL SECURITY WHILE ELIXIR FIXES SPEC BUGS ACROSS THE STACK

By RepoJournal · Filed · About Elixir & Phoenix

Phoenix is enforcing a hard cap on longpoll batch sizes to close a potential attack surface, and you need to know the upgrade path.

Phoenix shipped a breaking change that enforces a maximum of 100 entries per longpoll request [1], hardening against a known attack vector. The client has enforced this limit since 1.8.6, so if you're running older versions with heavy longpoll traffic, upgrade to 1.8.6 or 1.8.7 first before jumping to the latest. On the auth front, Phoenix now lets authToken be a function instead of a static value [2], giving you a cleaner path to refresh tokens on reconnect without mutating the socket directly. Meanwhile, Elixir fixed a spec bug in File.copy/3 [4] that was incorrectly excluding 0 as a valid return value, and Ecto patched wrong placeholder numbering when using fragment sources with schemas [3], a subtle bug that would break parameterized queries in edge cases.

Action items

References

  1. [1] Enforce longpoll batch size phoenixframework/phoenix
  2. [2] Allow authToken to be a function ↗ phoenixframework/phoenix
  3. [3] Fix wrong placeholder numbering when a `from` source is a `{fragment, schema}` tuple ↗ elixir-ecto/ecto
  4. [4] Fix spec of `File.copy/3` ↗ elixir-lang/elixir

FAQ

What changed in Elixir & Phoenix on July 4, 2026?
Phoenix is enforcing a hard cap on longpoll batch sizes to close a potential attack surface, and you need to know the upgrade path.
What should Elixir & Phoenix teams do about it?
If running Phoenix with heavy longpoll load, stage upgrade to 1.8.6 or 1.8.7 first, then move to latest • Update Ecto to pick up the fragment placeholder fix • Migrate authToken to function-based approach for cleaner token refresh
Which Elixir & Phoenix repositories shipped on July 4, 2026?
phoenixframework/phoenix, elixir-ecto/ecto, elixir-lang/elixir

For your repos

The showcase is a teaser.
Your wire is the product.

Same engine. Different stack. Below: what changes when the wire is yours.

Showcase wire

  • •14 famous open source orgs
  • •One wire per day
  • •Public, generic
  • •Read on the web, when you remember

Your wire

  • →Up to 1,500 of your repos - orgs, deps, vendors
  • →Morning and evening briefs
  • →Action items routed to your team
  • →Slack delivery, email, breaking-news CVE alerts

Want a hands-on demo first? Ask a current user for an invite link.